I just changed my Runbox password because of the Lastpass security patch but didn't receive any notification on my alternative email that my password had been change. Isn't this standard practice for webmail systems?

We do require a valid working alternative email address on registration. If you don't do this some features of the account are disabled. A valid alternative address is also required by our Terms of Service (section 6.2).

If you remove the alternative address later it may make it more difficult to provide customer support, especially in cases where you have lost access to your account.